Friday, August 10, 2018

Server Name Indication (SNI)


SNI (Server Name Indication) is an extension for SSL/TLS protocol. This extension allows the client to recognize the connecting hostname during the handshake process.  SNI permits a server to use different SSL certificates over the same IP address. Therefore, it serves correct certificates for those websites and delivers secured site to the customer. Each certificate is bind with particular FQDN, and with the help of SNI, the server picks the right certificate for the particular domain name.

A more generic solution for running several HTTPS servers on a single IP address is TLS Server Name Indication extension (SNI, RFC 6066), which allows a browser to pass a requested server name during the SSL handshake and, therefore, the server will know which certificate it should use for the connection. SNI is currently supported by most modern browsers, though may not be used by some old or special clients.

During ssl handshake "Client Hello" packet, you should see "Extension: server_name".

Latest Nignx server supports SNI. If you type: nginx -V
You should see: TLS SNI support enabled

https://www.ssl2buy.com/wiki/server-name-indication-sni-use-multiple-ssl-on-a-single-ip
http://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server

Wednesday, August 8, 2018

SSL certificate types


Speaking of SSL certificate types, usually we have two dimensions to categorize.

From validation dimension, there are three types of SSL certificate available today:
  1. Extended Validation (EV SSL)
  2. Organization Validated (OV SSL) 
  3. Domain Validated (DV SSL)
From domain name dimension, there are also three types of SSL certificate available today:
  1. Single-name (valid for only single domain)
  2. wildcard (valid for all subdomains)
  3. multi-name (valid for multiple domains/subdomains, called SAN or UC certificate)
You can have a wildcard cert *.domain.com which is valid for all subdomains.
You can have a single-name cert host.domain.com which is only valid for this host
You can have a multi-name cert host1.domain1.com, host2.domain2.com, this is called a SAN (Subject Alternative Name) Certificate. They are often called "UC-Certificate" as well.

For example:

When Wildcard SSL certificate is issued for *.domain.com, you can secure your unlimited number of sub domains over the main domain.

sub1.domain.com
sub2.domain.com
sub3.domain.com
sub*.domain.com

If the Wildcard SSL certificate is issued on *.sub1.domain.com, in that case you can secure all second level subdomains which are listed under the sub1.domain.com

aaa.sub1.domain.com
bbb.sub1.domain.com
ccc.sub1.domain.com
***.sub1.domain.com

If you want to secure limited number of different domains and second level domains, then you can choose multi domain SSL that can secure up to 100 domain names with a single certificate.

domain.com
sub1.domain.com
aaa.sub2.domain.com
domain2.net
domain3.org

Underneath


You may be wondering what the technical difference is between these types. It all comes down to the Subject Alternative Name (SAN) field that is embedded in the certificate when it’s issued.
When a certificate only has one SAN field and it contains a reference to a single website, then it’s a single-domain certificate.
If that one SAN field contains an asterisk in the website name (e.g. *.domain.com) then it’s a wildcard certificate.
If the certificate has many SAN fields, then it’s a multi-domain certificate. Multi-domain certificates sometimes have 100 or more SAN fields (with performance penalty), and some or all of these fields may contain wildcards, creating a hybrid “multi-domain wildcard” certificate.

Reference

https://serverfault.com/questions/104160/wildcard-ssl-certificate-for-second-level-subdomain
https://www.digicert.com/subject-alternative-name.htm
https://serverfault.com/questions/391311/how-many-domains-can-be-bound-with-one-ssl-certificate

Thursday, August 2, 2018

Top 25 Amusement Parks

Universal's Islands of Adventure
Orlando, Florida

Magic Kingdom Park
Orlando, Florida

Le Puy du Fou
Les Epesses, France

Universal Studios Hollywood
Los Angeles, California

Universal Studios Florida
Orlando, Florida

Disney's Animal Kingdom
Orlando, Florida

Europa-Park
Rust, Germany

Tivoli Gardens
Copenhagen, Denmark

The Island in Pigeon Forge
Pigeon Forge, Tennessee

Disneyland Park
Marne-la-Vallee, France

SeaWorld Orlando
Orlando, Florida

Beto Carrero World
Penha, Brazil

Disneyland Park
Anaheim, California

Disney's Hollywood Studios
Orlando, Florida

Disney California Adventure Park
Anaheim, California

Silver Dollar City
Branson, Missouri

Walt Disney Studios Park
Marne-la-Vallee, France

PortAventura
Salou, Spain

Universal Studios Singapore
Sentosa Island, Singapore

Hong Kong Disneyland
Hong Kong, China

Busch Gardens
Tampa, Florida

Efteling
Kaatsheuvel, The Netherlands

Leolandia
Capriate San Gervasio, Italy

Paultons Park
Romsey, United Kingdom

Universal Studios Japan
Osaka, Japan